rage.fail

aws-account-can-put-alternate-contact

explicit aws emits HasPermission

match (effective permission)

{ "action": "account:PutAlternateContact", "resource_type": "AWS::Account::Account" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Account node>`
permissions	`account:PutAlternateContact`

Narrative

{principal.name} can set an alternate (Security/Billing/Operations) contact on {account.name} (account:PutAlternateContact).

Raw rule rules/explicit/aws-account.yaml

id: aws-account-can-put-alternate-contact
emits: HasPermission
applies_to:
- aws
match_effective_permission:
  action: account:PutAlternateContact
  resource_type: AWS::Account::Account
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Account node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - account:PutAlternateContact
  narrative: '{principal.name} can set an alternate (Security/Billing/Operations) contact on {account.name}
    (account:PutAlternateContact).'